.NET Core中RESTful Web API间OAuth2服务器到服务器通信问题

Got it, since you already have the basics of securing APIs with OAuth and using HttpClient down, let's zero in on your specific scenario: chaining server-side calls between Web API 1 → Web API 2 → Web API 3 after the initial UI call to API 1. The key here is either passing the user's identity through the chain (using the On-Behalf-Of flow) or using service-level credentials if user context isn't needed.

1. On-Behalf-Of (OBO) Flow: Preserving User Context #

This is the go-to if every API call in the chain needs to act on behalf of the original UI user (e.g., logging actions to their account, enforcing user-specific permissions). Here's how it works step-by-step:

• Setup First: Register each API as a client in your OAuth identity provider (IdP), and configure the IdP to allow each upstream API to use the OBO grant type to request tokens for the downstream API. For example, API 1's client ID needs permission to request tokens for API 2, and API 2's client ID needs permission for API 3.
• Capture the Original User Token: When API 1 receives the UI's request, extract the user's access token from the Authorization: Bearer <token> header.
• Request a Token for the Downstream API: API 1 uses its own client credentials (client ID + secret/certificate) plus the user's token to ask the IdP for a new access token targeted at API 2. The grant type here is urn:ietf:params:oauth:grant-type:jwt-bearer.
• Pass the New Token to API 2: Use HttpClient to call API 2, attaching the newly obtained token in the Authorization header.
• Repeat the Flow: API 2 does the same thing with the token it receives from API 1 to get a token for API 3, and so on down the chain.

Example Code (C# with IdentityModel) #

Here's a simplified snippet for API 1 requesting an OBO token to call API 2:

// Extract the original user token from the incoming request
var userAccessToken = Request.Headers.Authorization?.Parameter;
if (string.IsNullOrEmpty(userAccessToken))
{
    return Unauthorized();
}

// Request an OBO token for API 2
var tokenClient = new TokenClient(
    "https://your-idp-domain/token",
    "api1-client-id",
    "api1-client-secret" // Or use a certificate for better security
);

var tokenResponse = await tokenClient.RequestJwtBearerTokenAsync(new JwtBearerTokenRequest
{
    Address = "https://your-idp-domain/token",
    Assertion = userAccessToken,
    Scope = "api2.read api2.write", // Only the permissions API 2 needs
    GrantType = "urn:ietf:params:oauth:grant-type:jwt-bearer"
});

if (tokenResponse.IsError)
{
    return StatusCode(StatusCodes.Status500InternalServerError, tokenResponse.Error);
}

// Call API 2 with the new token
using var httpClient = new HttpClient();
httpClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", tokenResponse.AccessToken);
var api2Response = await httpClient.GetAsync("https://api2.example.com/protected-endpoint");

2. Client Credentials Flow: Service-to-Service Without User Context #

If the chained calls don't need to tie back to the original UI user (e.g., background processing, shared service operations), use the Client Credentials flow instead. This lets each API authenticate as itself to the downstream API:

• Setup: Register each API as a client in your IdP, and grant each client the necessary permissions to access the downstream API. For example, API 1's client needs "api2.access" scope, API 2's client needs "api3.access" scope.
• Request a Service Token: Each API uses its own client credentials to request an access token directly from the IdP (grant type client_credentials).
• Call the Downstream API: Attach the service token to the HttpClient request's Authorization header.

This flow is simpler since you don't need to pass the user's token along, but it doesn't preserve user identity.

Critical Best Practices #

• Cache Tokens: Don't request a new token for every call. Use a cache (like IMemoryCache or a distributed cache) to store tokens until they're close to expiring. This reduces load on your IdP and speeds up calls.
• Least Privilege: Request only the scopes your downstream API actually needs. Don't ask for broad permissions that aren't required.
• Secure Credentials: Never hardcode client secrets or certificates. Store them in a secure vault (like Azure Key Vault, HashiCorp Vault) or environment variables.
• Validate Tokens: Every API should validate the incoming token's signature, issuer, audience, and expiration time before processing the request. Most OAuth libraries (like Microsoft.Identity.Web) handle this automatically.

内容的提问来源于stack exchange，提问作者monty